Key takeaways
- A GEO platform looks harmless because it tracks prompts about your brand. But the moment you connect crawler logs, visitor analytics, Search Console or a CMS, it handles real customer and employee data, including IP addresses.
- An "EU data region" is evidence, not proof. Ask about support access, disaster recovery and subprocessors that can touch data from outside the EU.
- Ask for the DPA, the subprocessor list, the notice period for changes, breach timelines and deletion terms before the demo ends, not after the contract is drafted.
- Standard uptime SLAs miss the GEO-specific failure: the dashboard is up but prompts have silently stopped running. Define it in writing.
- Certifications (ISO 27001, SOC 2) gather evidence. They do not replace checking your actual configuration.
Why GEO vendors need their own procurement checklist
Most procurement teams file GEO and AI visibility platforms under "marketing analytics" and apply a light-touch review. That works for the first week. Then someone connects Cloudflare logs for crawler analytics, installs a tracking script, links Google Search Console and wires up CMS publishing, and the tool is suddenly inside your data path.
The broader AI procurement literature is blunt about how contracts go wrong. One 40-question enterprise checklist by Arjun Jaggi claims 43% of AI contracts it reviewed did not say whether customer data could be used for general model training, and 61% had no definition of an AI "outage" that triggers SLA remedies. Treat those numbers as one author's sample, not a market statistic. The pattern is still familiar to anyone who has sat through a security review.
GEO vendors add three wrinkles of their own:
- They collect data from third-party AI platforms, so there are two data flows to assess: what they pull in about AI answers, and what they take from your systems.
- Some write back to your site through CMS publishing, which is a permissions question as much as a privacy one.
- The category is young. Many vendors are small, and compliance maturity varies a lot. One European vendor's own comparison guide admits that most European vendors, itself included, did not yet hold SOC 2 at the time. That is a vendor's claim, so verify it, but the direction is plausible.
If you are still building the shortlist, the directory at bestgeosoftware.com is a reasonable place to see who is in the market before you send anyone a questionnaire.
Start with the data flow, not the vendor
The Lis.Legal guide on AI vendor contracts makes a point I agree with: begin with the intended use and data flow, then assess the vendor. A DPA, a security certificate and an EU region are useful evidence, but none of them tells you whether the tool is suitable for your process.
Before you send a questionnaire, write down which of these your GEO deployment will touch:
- Prompts and tracked brand terms (usually low sensitivity, but may reveal unreleased products or competitor strategy)
- AI responses and citations collected from ChatGPT, Gemini, Perplexity and others
- Server or CDN logs for AI crawler analytics, which can contain IP addresses and are personal data under GDPR
- Visitor analytics events from your own site
- Google Search Console and Bing Webmaster data
- CMS credentials or tokens if the vendor publishes content for you
- Team member names, emails and activity logs
The crawler log line matters most. Promptwatch's AI crawler traffic report is a useful illustration of what that data looks like: it covers IP-verified requests from OpenAI, Anthropic, Google, Perplexity and Mistral between June 8 and September 6, 2026, and shows OpenAI at 79.8% of verified requests in the Aug 31 to Sep 6 week, down from 94.8% in early June. A vendor offering this kind of analysis for your site is ingesting your raw request data. That is a data-handling question, and it should be on the checklist.
Category 1: Data handling and GDPR
These are the questions I would put to every vendor, in writing, before any pilot involves production data.
Roles and the DPA
Is the vendor a processor, a controller, or both? A vendor may process data on your instructions for the core service and decide its own purposes for other operations, such as product analytics or benchmarking. Calling the vendor a "processor" in the contract does not settle the legal basis for the second kind of use. Ask the vendor to list each operation and say which role applies.
Will you sign a DPA that meets GDPR Article 28? Request it up front. Check that it covers the actual product you are buying, not just the main app. An agreement covering only the named application can leave connected services (crawler ingestion, browser extensions, API, MCP server) outside the assumed arrangement.
What data does the vendor use for its own purposes? The Lis.Legal guide suggests checking training, fine-tuning, evaluation and other reuse separately. For a GEO platform the realistic version is: does the vendor use your prompts, responses or logs to improve its models, or publish them in benchmarks? Aggregated and non-identifiable data in public research is a normal practice (Promptwatch publishes its dataset that way through Promptwatch Data), but you should confirm in writing that your account-level data is not exposed.
Training and secondary use
The Jaggi checklist says the training-use answer should be explicit and in writing, and I would go further: ask for an affirmative prohibition in the contract, not an opt-out buried in settings. Also ask whether the vendor can share anonymized or aggregated insights derived from your data with others, and read any anonymization claim carefully.
Retention and deletion
- What is the default retention for prompts, responses, crawler logs and visitor events?
- Can you configure shorter retention or a zero-retention setup for logs?
- What happens at termination: export format, deletion deadline, deletion certificate?
- Are backups included in the deletion commitment, and for how long do they persist?
Breach notification
Under GDPR the controller has 72 hours to notify the regulator once aware of a breach, so your processor must tell you much faster. A Truto guide on MCP and GDPR notes DPA breach windows are typically 24 to 72 hours. Aim for the short end, and make sure the contract says when the clock starts and what the vendor must tell you in the first notice. Lis.Legal has a good explainer on who holds the 72 hours.
Category 2: EU hosting and data residency
"Hosted in the EU" is the most abused phrase in vendor security pages. Pin it down.
Questions to ask
- Which region holds primary storage, and which holds standby or backup? incident.io's GDPR page is a good model for specificity: Belgium primary, Netherlands standby, evidenced in the Trust Center and order form. Ask GEO vendors for that level of detail.
- Can the region be locked, and under what support, safety or disaster-recovery conditions can data leave it? The Wavect questionnaire asks exactly this and suggests requesting configuration documentation and tested routing behaviour.
- Can people outside the EU access the data for support? Lis.Legal makes the point that an EU hosting region can coexist with access from another country. Remote access is a transfer.
- Which model or LLM providers process your data, and where? Many GEO platforms use LLMs to summarize responses, score sentiment or draft content. Those providers can be subprocessors.
- Where does data collection happen? Tracking tools query AI platforms from various countries and languages. Ask what from that collection pipeline is stored where.
- If any data leaves the EEA, which transfer mechanism applies (SCCs, adequacy) and is there a transfer impact assessment?
Contract language to request
The Wavect questionnaire suggests wording along these lines: no location change or remote access outside approved countries without a documented legal mechanism and agreed controls. Add a notice period for any region change and a right to terminate without penalty if you object.
The Truto guide offers a useful rule of thumb here: any vendor in the data path that can technically read, store or replay EU personal data is a subprocessor. Caching layers and logging tools can quietly become unauthorised subprocessors. Ask the vendor to show a diagram of where EU data is processed, not just a sentence.
Category 3: Subprocessors and change control
- Request the current subprocessor list with entity, purpose and processing location.
- Ask how changes are announced and how long you have to object. Opper AI commits to 30 days' notice before adding or replacing a subprocessor, which is a decent benchmark for your own clause.
- Ask what happens if you object and the vendor proceeds anyway. The answer should be termination with a refund of prepaid fees.
- Check that flow-down obligations bind subprocessors to equivalent terms.
Lis.Legal's piece on what to do when a SaaS provider changes a subprocessor is worth handing to whoever will own the vendor relationship after signature.
Category 4: Security certifications and access control
Certificates are evidence, nothing more. The Wavect FAQ makes the same point: a SOC 2 or ISO 27001 report gathers procurement evidence but does not prove your configuration is safe.
| Evidence | What it tells you | What it does not tell you |
|---|---|---|
| ISO/IEC 27001 | An information security management system exists and is audited | That your specific data flows are covered or configured well |
| SOC 2 Type II | Controls operated over a period, tested by an auditor | Where data is hosted, or GDPR compliance |
| ISO/IEC 42001 | AI management system maturity | Anything about a vendor's data processing agreement |
| GDPR DPA | Contractual Article 28 commitments | Whether actual settings and data flows match the paper |
| Pen test summary | Technical weaknesses found at a point in time | Ongoing exposure |
Regulated European enterprises increasingly ask for ISO 42001 alongside SOC 2 Type II and ISO 27001, according to Truto's guide. Do not make it a hard gate for every GEO vendor yet, but ask what is planned.
Also ask about:
- SSO and SCIM, role-based access, project-level permissions
- An audit log that records whether a change came from the UI, API, an MCP client or an AI agent
- Scoped API keys (read-only versus write)
- Multi-tenant isolation and how cross-tenant incidents are detected
- Permissions needed for CMS integrations. Can the vendor publish live, or only create drafts?
When I compare vendors I look at which certifications they actually hold today, not what is on a roadmap. As an example from the vendors I can point to: Promptwatch states it is ISO/IEC 27001 certified and GDPR compliant, with data handled by an EU-based company. Verify the certificate and scope in the vendor's trust documentation rather than taking a web page's word for it, and do the same for every other vendor on your list. One competitor comparison guide claims Profound holds SOC 2 on its Enterprise plan; I could not verify that against Profound's own site, so check it directly.
Category 5: SLA terms that fit GEO tools
An uptime percentage is the least interesting number in a GEO contract. The Jaggi checklist observes that traditional SLAs define uptime as the system being accessible, whereas AI systems can be accessible but produce degraded outputs. GEO platforms have a version of that failure: the dashboard loads, but a monitor stopped collecting, or a platform changed its interface and the scraper returns empty answers.
What to define
| SLA element | What to ask for |
|---|---|
| Availability | Monthly uptime for app, API and any MCP server, measured separately |
| Data freshness | Maximum delay between a scheduled prompt run and results appearing; share of scheduled runs completed |
| Collection failures | Definition of a failed run, how it is flagged in the UI, and whether failed runs are credited back |
| Support response | Severity levels with first-response and resolution targets, plus support hours and time zone |
| Breach notification | Hours from discovery, and what the first notice contains |
| Incident communication | Status page, written root cause analysis within a set number of days |
| Remedies | Service credits, termination right after repeated misses |
| Model and platform changes | Notice when a tracked AI platform is added, retired or changes collection method |
| API limits | Documented rate limits and notice before changes |
The Jaggi list also asks for response time at multiple percentiles and a defined accuracy floor. For GEO, the equivalent is run-completion rate and collection accuracy: ask how the vendor validates that a captured response matches what a real user would see. That is where the difference between real-UI collection and API-only collection becomes a contract topic, because answers and citations can differ between the two. Promptwatch documents how it handles this in its data collection guide.
To turn accepted promises into measurable terms, the Wavect AI agent SLA template is a decent starting point, although it targets agent products rather than visibility platforms.
Category 6: Contract, exit and portability
- Data export in open formats (CSV, JSON, API) for prompts, responses, citations and crawler data, with no extra fee at exit.
- Ownership of content the vendor generates for you. If the vendor's agents write and publish pages, confirm that you own them and that the vendor retains no licence beyond operating the service.
- A termination assistance period, not just a cutoff date.
- Liability caps that reflect data protection exposure, not just fees paid.
- Audit rights, or at least the right to receive current third-party audit reports annually.
- Notice periods for price changes and for sunsetting features.
On vendor stability, ask about funding, customer count and how long the company has existed. GEO is a category where several players launched within the last two years, so a shaky balance sheet is a real continuity risk. Ask for a code or data escrow only if the use case justifies it; for most marketing deployments, a clean export is enough.
A scoring approach that legal, security and marketing can share
The Agent Works guidance says checklists need to be scorable by legal, security and data owners independently before signature. I would do it like this:
- Legal scores the DPA, roles, transfers, liability and exit.
- Security scores certifications, access control, logging and subprocessors.
- Marketing or SEO scores the SLA items that affect day-to-day work: freshness, failures, support.
- Mark each item as pass, conditional (needs a contract clause) or fail.
- Any fail on training use, EU data location or breach notification is a stop, not a negotiation.
Keep a column for evidence links. A statement on a sales call is not evidence; a trust center page, a signed DPA or a configuration screenshot is.
Comparing GEO vendors on compliance: what to check yourself
I could not find reliable, current public comparisons of GEO vendors' hosting regions, certifications and SLA terms, and vendor-written comparison pages are marketing. So build your own table and fill it from each vendor's trust center and DPA. Here is a skeleton:
| Check | Vendor A | Vendor B | Vendor C |
|---|---|---|---|
| ISO 27001 certificate and scope | |||
| SOC 2 Type II report | |||
| EU region (primary and standby) | |||
| Support access from outside the EU | |||
| Subprocessor list and notice period | |||
| Training-use prohibition in contract | |||
| Breach notification hours | |||
| Freshness and collection SLA | |||
| Export format and deletion deadline | |||
| SSO, audit log, scoped keys |
Tools you might put in that table include Profound, Peec AI, Otterly.AI, Scrunch, AthenaHQ and Promptwatch, alongside SEO suites that have added AI tracking.
For a wider list of options, the AI rank tracking directory covers the monitoring-first end of the market, while Promptwatch's own side-by-side comparison is vendor-authored, so read it with that in mind.
Red flags during the review
- The vendor cannot name its subprocessors or points you to a marketing page instead of a list.
- "EU hosting" with no mention of backups, support access or LLM providers.
- Training use described as "we don't currently" rather than a contractual prohibition.
- No written incident communication process. The Jaggi checklist says vendors who cannot describe this in writing do not have a functioning one.
- SLAs that cover only uptime, with no definition of failed collection.
- A DPA that covers the web app but not the API, crawler ingestion or extensions.
- Reluctance to provide a sample export.
What to do this week
Pick the one GEO workflow you actually plan to run, list the data it touches, and send the vendor the shortlist of questions in categories 1 to 3 above. Ask for the DPA, subprocessor list and trust center link in the same email. A vendor who answers in a day with documents is easy to work with. One who answers with a deck is telling you how the SLA will be handled later.
If you want a second pair of eyes on the SEO and GEO side of the decision, 1001 SEO Media runs vendor evaluations as part of its audit and consulting work. Otherwise, the questions above will get you most of the way on your own.